SY0-301 · Question #260
A recent intrusion has resulted in the need to perform incident response procedures. The incident response team has identified audit logs throughout the network and organizational systems which hold d
The correct answer is C. Record time offset. Without a centralized NTP (Network Time Protocol) server, each system on the network maintains its own clock independently. Over time, clocks drift and become unsynchronized. When the incident response team tries to correlate audit logs from multiple systems (servers, firewalls,
Question
A recent intrusion has resulted in the need to perform incident response procedures. The incident response team has identified audit logs throughout the network and organizational systems which hold details of the security breach. Prior to this incident, a security consultant informed the company that they needed to implement an NTP server on the network. Which of the following is a problem that the incident response team will likely encounter during their assessment?
Options
- AChain of custody
- BTracking man hours
- CRecord time offset
- DCapture video traffic
How the community answered
(16 responses)- A6% (1)
- B19% (3)
- C69% (11)
- D6% (1)
Explanation
Without a centralized NTP (Network Time Protocol) server, each system on the network maintains its own clock independently. Over time, clocks drift and become unsynchronized. When the incident response team tries to correlate audit logs from multiple systems (servers, firewalls, workstations) to reconstruct the attack timeline, the timestamps will not align - each device may be minutes or hours off from the others. This is the 'time offset' problem. Correlating events across logs becomes unreliable or impossible without synchronized timestamps. Option A (chain of custody) relates to evidence handling, not log correlation. Option B (man hours) is an administrative concern. Option D (video traffic capture) is unrelated to the NTP issue.
Topics
Community Discussion
No community discussion yet for this question.